CVE-2026-106025 · Other
NO FIX YET
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 exposes a REST API endpoint that updates order shipment statuses without proper access control. An unauthenticated attacker can change order statuses and shipment metadata.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Stores running the Cargo Shipping Location for WooCommerce WordPress plugin before version 6.0 are exposed, because its REST endpoint for order shipment statuses does not check who is calling it. Sites without this plugin, or with version 6.0 or later, are not affected by this description.
Not affected if plugin-not-installed, plugin-version-6.0-or-later
Who cares cargo-shipping-location, woocommerce, wordpress
6.0.Unknown from the sources.
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.